Related Big Read: The blast radius problem: how agentic AI broke the permissions model
Related assets: Shadow agents as shadow workforce risk; The economics of centralised failure; Agentic blast radius
For AI agents, the attack surface is not a place. It is the set of actions and systems the agent can reach once it is trusted with permission.
Agent governance is a privileged access problem.
As AI agents gain permission to read, write, send, execute, and trigger actions across enterprise systems, perimeter thinking becomes less useful.
The risk is not only where the request comes from. It is what the authorised actor can do after the request is accepted.
Why permission is the surface
An agent with read-only access is one kind of risk.
An agent that can mutate data, send communications, execute code, alter configuration, call tools, or trigger workflows is another. The difference is not philosophical. It is architectural.
If permissions are broad, inherited, poorly logged, or hard to revoke, the agent becomes a fast-moving trust concentrator.
Governance cannot rely solely on good intent or vendor assurance. It has to be expressed through permission design.
Use this checklist before an AI agent receives meaningful authority. Work through the five areas to identify what the agent can reach, change, expose, and how quickly its access can be revoked.
High-level checklist: permission control
Scope and access
Name every system the agent can access. Separate read-only access from mutating access. Identify what the agent can do without human approval.
Mutation controls
List every action that can change data, trigger a workflow, send communication, or alter configuration. Require deterministic approval for high-impact actions.
Telemetry and auditability
Log what the agent accessed, what tool it called, and what output or mutation followed. Vague application logs are not enough.
Context hygiene
Know what enters the context window, what is retained, and where indirect leakage can occur through prompts, logs, or intermediate outputs.
Revocation readiness
Test whether access can be revoked immediately and whether a manual fallback exists if the agent is taken offline.
The executive test
Before any agent deployment, ask:
What is the most consequential thing this agent can do with valid permission?
If that answer has not been written down in plain English, the organisation is not approving a controlled workflow.
It is approving an attack surface it has not mapped.
